BSOD when returning from Hibernate minidump attached

[beejohnmustard]

BSOD when returning from Hibernate Bugcheck 50 {ffffaa8004819ae8}

Hi All,

I have a Macbook Air running Windows 7 x64 on bootcamp with the latest bootcamp drivers and latest windows 7 updates. All updates have been completed, I didn't leave any out. Also I recently had the apple store thoroughly check the system for any memory issues, physical hardware issues and they said they could not find any problems.

Anyways when I try to turn the computer back on when it has been hibernated I will get a bsod sometimes immediately, sometimes 2min later, sometimes not after hibernate. But it definitely seems to be related to hibernate.

I have posted the minidump, I tried to do the analysis myself but couldn't figure it out. Here is some of the information windbg gave me.

I have uploaded the minidump (the .dmp file had to be zipped because the forum wouldn't allow it).


Here is the info from windbg:





ADDITIONAL_DEBUG_TEXT:
Use '!findthebuild' command to search for the target build information.
If the build information is available, run '!findthebuild -s ; .reload' to set symbol path and load symbols.

FAULTING_MODULE: fffff80002a00000 nt

DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc481

WRITE_ADDRESS: unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPoolCodeStart
unable to get nt!MmPoolCodeEnd
ffffaa8004819ae8

FAULTING_IP:
nt+597a3
fffff800`02a597a3 488909 mov qword ptr [rcx],rcx

MM_INTERNAL_CODE: 7

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0x50

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from fffff80002af253b to fffff80002a75bc0

STACK_TEXT:
fffff880`07d8c3c8 fffff800`02af253b : 00000000`00000050 ffffaa80`04819ae8 00000000`00000001 fffff880`07d8c530 : nt+0x75bc0
fffff880`07d8c3d0 00000000`00000050 : ffffaa80`04819ae8 00000000`00000001 fffff880`07d8c530 00000000`00000007 : nt+0xf253b
fffff880`07d8c3d8 ffffaa80`04819ae8 : 00000000`00000001 fffff880`07d8c530 00000000`00000007 fffff8a0`03520010 : 0x50
fffff880`07d8c3e0 00000000`00000001 : fffff880`07d8c530 00000000`00000007 fffff8a0`03520010 fffff880`07d8c620 : 0xffffaa80`04819ae8
fffff880`07d8c3e8 fffff880`07d8c530 : 00000000`00000007 fffff8a0`03520010 fffff880`07d8c620 fffff880`0129f947 : 0x1
fffff880`07d8c3f0 00000000`00000007 : fffff8a0`03520010 fffff880`07d8c620 fffff880`0129f947 fffff880`07d8c538 : 0xfffff880`07d8c530
fffff880`07d8c3f8 fffff8a0`03520010 : fffff880`07d8c620 fffff880`0129f947 fffff880`07d8c538 fffffa80`04db6180 : 0x7
fffff880`07d8c400 fffff880`07d8c620 : fffff880`0129f947 fffff880`07d8c538 fffffa80`04db6180 fffffa80`05ec07a0 : 0xfffff8a0`03520010
fffff880`07d8c408 fffff880`0129f947 : fffff880`07d8c538 fffffa80`04db6180 fffffa80`05ec07a0 fffff880`07d8c538 : 0xfffff880`07d8c620
fffff880`07d8c410 fffff880`07d8c538 : fffffa80`04db6180 fffffa80`05ec07a0 fffff880`07d8c538 00000000`00000001 : Ntfs+0x9c947
fffff880`07d8c418 fffffa80`04db6180 : fffffa80`05ec07a0 fffff880`07d8c538 00000000`00000001 fffff880`011c0000 : 0xfffff880`07d8c538
fffff880`07d8c420 fffffa80`05ec07a0 : fffff880`07d8c538 00000000`00000001 fffff880`011c0000 fffff6d5`400240c8 : 0xfffffa80`04db6180
fffff880`07d8c428 fffff880`07d8c538 : 00000000`00000001 fffff880`011c0000 fffff6d5`400240c8 f8a009dc`10980400 : 0xfffffa80`05ec07a0
fffff880`07d8c430 00000000`00000001 : fffff880`011c0000 fffff6d5`400240c8 f8a009dc`10980400 ffff0800`00000011 : 0xfffff880`07d8c538
fffff880`07d8c438 fffff880`011c0000 : fffff6d5`400240c8 f8a009dc`10980400 ffff0800`00000011 00000000`00000000 : 0x1
fffff880`07d8c440 fffff6d5`400240c8 : f8a009dc`10980400 ffff0800`00000011 00000000`00000000 fffff6fb`7db55000 : fileinfo+0x1000
fffff880`07d8c448 f8a009dc`10980400 : ffff0800`00000011 00000000`00000000 fffff6fb`7db55000 fffff880`07d8c530 : 0xfffff6d5`400240c8
fffff880`07d8c450 ffff0800`00000011 : 00000000`00000000 fffff6fb`7db55000 fffff880`07d8c530 fffff8a0`03520140 : 0xf8a009dc`10980400
fffff880`07d8c458 00000000`00000000 : fffff6fb`7db55000 fffff880`07d8c530 fffff8a0`03520140 ffffaa80`04819ae8 : 0xffff0800`00000011


STACK_COMMAND: kb

FOLLOWUP_IP:
fileinfo+1000
fffff880`011c0000 ?? ???

SYMBOL_STACK_INDEX: f

SYMBOL_NAME: fileinfo+1000

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: fileinfo

IMAGE_NAME: fileinfo.sys

BUCKET_ID: WRONG_SYMBOLS

Followup: MachineOwner
---------

 

[beejohnmustard]

Bump... anyone?

 

[beejohnmustard]

bump... anyone?

 

[beejohnmustard]

Please help?

 

[beejohnmustard]

Could anyone shed some insight please? Thank you

 

[beejohnmustard]

Please help?

 

[beejohnmustard]

bump, any help please?

 

[koolkat77]

Allot of important info is missing from your zip, please follow http://www.sevenforums.com/bsod-help-support/96879-blue-screen-death-bsod-posting-instructions.html to grab all and upload a new report here.

 

[beejohnmustard]

Hi All,

I have updated my diagnosis file per Koolkat. Thanks Koolkat!

Any help anyone? Thanks

 

[koolkat77]

Microsoft (R) Windows Debugger Version 6.2.9200.20512 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\admin\Downloads\KENNY-PC-Tue_07_22_2014_165558_09\072114-28017-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.18409.amd64fre.win7sp1_gdr.140303-2144
Machine Name:
Kernel base = 0xfffff800`02a58000 PsLoadedModuleList = 0xfffff800`02c9b890
Debug session time: Tue Jul 22 05:02:42.502 2014 (UTC + 6:00)
System Uptime: 0 days 0:00:49.455
Loading Kernel Symbols
...............................................................
................................................................
...........................................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41790, fffffa800046c8c0, ffff, 0}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+35084 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041790, A page table page has been corrupted. On a 64 bit OS, parameter 2
	contains the address of the PFN for the corrupted page table page.
	On a 32 bit OS, parameter 2 contains a pointer to the number of used
	PTEs, and parameter 3 contains the number of used PTEs.
Arg2: fffffa800046c8c0
Arg3: 000000000000ffff
Arg4: 0000000000000000

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_41790

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  vbc.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80002b3ed50 to fffff80002acdbc0

STACK_TEXT:  
fffff880`06cb3588 fffff800`02b3ed50 : 00000000`0000001a 00000000`00041790 fffffa80`0046c8c0 00000000`0000ffff : nt!KeBugCheckEx
fffff880`06cb3590 fffff800`02aba3df : fffffa80`00000000 00000000`0146ffff 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x35084
fffff880`06cb3750 fffff800`02acce53 : ffffffff`ffffffff fffff880`06cb3a20 fffff880`06cb3a28 00000000`00008000 : nt!NtFreeVirtualMemory+0x61f
fffff880`06cb3850 fffff800`02ac9410 : fffff800`02d4b477 00000000`00000000 00000000`00000000 fffffa80`053bdb30 : nt!KiSystemServiceCopyEnd+0x13
fffff880`06cb39e8 fffff800`02d4b477 : 00000000`00000000 00000000`00000000 fffffa80`053bdb30 00000000`c0000008 : nt!KiServiceLinkage
fffff880`06cb39f0 fffff800`02dbb2dc : 00000000`01370000 00000000`00000000 00000000`c0000008 fffff6fc`40036568 : nt!RtlFreeUserStack+0x27
fffff880`06cb3a20 fffff800`02dba1be : fffffa80`05e4e060 fffffa80`053bdb30 fffff880`06cb3ec0 fffff880`06cb3c00 : nt!PspInsertThread+0x81c
fffff880`06cb3ba0 fffff800`02dbe029 : 00000000`00000000 00000000`00000000 00000000`00000001 fffff880`06cb43d0 : nt!PspCreateThread+0x246
fffff880`06cb3e20 fffff800`02acce53 : fffff880`06cb4620 fffff880`06cb45f8 00000000`00000468 00000000`00000000 : nt!NtCreateThreadEx+0x25d
fffff880`06cb4570 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+35084
fffff800`02b3ed50 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+35084

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  531590fb

FAILURE_BUCKET_ID:  X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+35084

BUCKET_ID:  X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+35084

Followup: MachineOwner
---------

Take memtest. Run for 8 passes and test each stick in a know good slot for an additional 6 passes.

• RAM - Test with Memtest86+

The goal is to test all the RAM sticks and all the motherboard slots.

Check your motherboard manual to ensure the RAM sticks are in the recommended motherboard slots. Some motherboards have very specific slots required for the number of RAM sticks installed.

If you get errors, stop the test and continue with the next step.

1. Remove all but one stick of RAM from your computer (this will be RAM stick #1), and run Memtest86 again, for 7 passes.

*Be sure to note the RAM stick, use a piece of tape with a number, and note the motherboard slot.
​

If this stick passes the test then go to step #3.

2. If RAM stick #1 has errors, repeat the test with RAM stick #2 in the same motherboard slot.

*If RAM stick #2 passes, this indicates that RAM stick #1 may be bad. If you want to be absolutely sure, re-test RAM stick #1 in another known good slot.
​

*If RAM stick #2 has errors, this indicates another possible bad RAM stick, a possible motherboard slot failure or inadequate settings.
​

3. Test the next stick of RAM (stick #2) in the next motherboard slot.

*If this RAM stick has errors repeat step #2 using a known good stick if possible, or another stick.
​

*If this RAM stick has no errors and both sticks failed in slot#1, test RAM stick #1 in this slot.
​

4. If you find a stick that passes the test, test it in all the other motherboard slots.

If Part 2 testing shows errors, and all tests in Part 3 show errors, you will need to test the RAM sticks in another computer and/or test other RAM in your computer to identify the problem.

In this way, you can identify whether it is a bad stick of RAM, a bad motherboard, or incompatibility between the sticks.

   Information

Errors are sometimes found after 8 passes.

   Tip

Memtest should be done overnight.

 

[beejohnmustard]

Hi All,

I did the memtest, I set it for 8 passes instead of the default 4. It came back with 0 errors.

It's also a macbook air, so I could not re-seat the ram. Please advise what to do from here. Thanks for all of your help Koolkat!

 

[koolkat77]

Post an updated log.

 

[beejohnmustard]

Hi Koolkat,

I don't have any new crashes since then. My original log should have contained two crashes (minidumps). Do you want me to do the log one more time?

Or did you want the log from memtest86? I tried to save the html log but it said it could not write to the USB drive, I can take a picture if you would like?

Thanks again for being so helpful. Best,

 

[beejohnmustard]

Here is a new log I created with the forum tool. Please help, thanks

 

[koolkat77]

Those dumps indicated possible RAM issues. Anyways.

Remove AVG and use MSE.

Microsoft Security Essentials is recommended from a strict BSOD perspective, compatibility & stability
compared to other antivirus or internet security software. It is free and lightweight:-

• Microsoft Security Essentials - Free Antivirus for Windows
• Malwarebytes: Removes malware including viruses, spyware, worms and trojans, plus it protects your computer
• http://www.sevenforums.com/system-security/206705-good-free-system-security-combination.html

   Warning

Do not start the free trial of Malware Bytes; remember to deselect that option when prompted.

Run the System File Checker that scans the of all protected Windows 7 system files and replaces incorrect corrupted, changed/modified, or damaged versions with the correct versions if possible:

• Click on the rb:
• Type CMD on Search
• Left click and Run as Administrator
• Type SFC /scannow

Full tutorial here:

• http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

Run Disk Check on your Hard Drive for file system errors and bad sectors on it:

• How to Run Disk Check in Windows 7

Upload a screenshot of your hard disk using Crystal Disk Info:

• CrystalDiskInfo - Software - Crystal Dew World
• http://www.sevenforums.com/tutorials/9733-screenshots-files-upload-post-seven-forums.html

Make a hard drive test from the hard drive manufacturers website:

• Hard Drive Diagnostic Procedure

Test your Hard Drive with SeaTools:

• How to Use SeaTools for DOS and Windows Disk Check Utility

 

[beejohnmustard]

Update: when running memtest86 without AC power the laptop freezes. Is this normal? Should I look at RAM issues still?

I will follow your other advice...